bug-gnu-emacs
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#59544: [PATCH] Fixed lib-src/etags.c command execute vulnerability


From: Eli Zaretskii
Subject: bug#59544: [PATCH] Fixed lib-src/etags.c command execute vulnerability
Date: Sat, 26 Nov 2022 15:21:49 +0200

> Date: Sat, 26 Nov 2022 11:09:26 +0800
> Cc: 59544 <59544@debbugs.gnu.org>
> From: lux <lx@shellcodes.org>
> 
> +          linebuffer line;
> +          linebuffer_init (&line);
> +          while (readline_internal (&line, tag_f, tagfile) > 0)

This needs a minor adjustment: readline_internal removes the CR characters
from CR-LF end-of-lines, so I think using it unaltered will convert files
with DOS-style EOLs to Unix-style EOLs, because we write them with a single
newline at the end.  I think the best fix is to add one more argument to
readline_internal, which, if non-zero, will cause it to avoid removing the
CR characters.

> +ctags_update: CTAGS.good_update ${infiles}
> +     echo > CTAGS

This "echo" command creates an empty CTAGS file.  It would be better to have
at least a few lines there, so we could make sure the new code actually
removes some lines from its input.

Thanks.





reply via email to

[Prev in Thread] Current Thread [Next in Thread]